This KB talks about the error and the background of the same, the platform issue/fix that caused this and how the same is taken care in an environment like SDWAN CSO

Once we collect the log from Kibana we see following error:

<nc:error-path>\n[edit groups stage1-security security nat source rule-set underlay-mgmt-traffic-nat rule r3 match]\n</nc:error-path>\n

<nc:error-info>\n<junos:source-daemon>nsd</junos:source-daemon>\n<nc:bad-element>\nsource-address 192.168.0.1/29\n</nc:bad-element>\n</nc:error-info>\n

<nc:error-message>\nConfigured address is not the network address of the prefix '29'\n

CSO SDWAN manages SRX devices.

In above scenario the NAT config for Single CPE required to use /29 subnet.

Prior to 22.2R3-S4.11, NAT config was allowed with any IP within subnet of /29 to be defined but with this specific version NAT config only need network address.

This broke the Intent based CSO SDWAN orchestration as it was allowed to configure non network address too.

FIX: Onboarding/RMA CSO templates were modified internally to tweak the NAT config with only network address